In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: mgmt: fix pending command UAF in EIR updates
MGMTOPSETLOCALNAME is handled asynchronously on powered controllers and can run setnamesync(). When the controller is BR/EDR capable, setnamesync() updates the local name and then rebuilds EIR data through eircreate(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMTOPADDUUID and MGMTOPREMOVE_UUID.
pendingeirorclass() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMTOPSETLOCALNAME. In addition, it walked hdev->mgmtpending without hdev->mgmtpendinglock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pendingeiror_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.
Take hdev->mgmtpendinglock while scanning hdev->mgmtpending and treat MGMTOPSETLOCALNAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SETLOCALNAME request does not modify hdev->shortname.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74511.json"
}